2026-04-13 01-48-09

May 25, 2026 14:12 · 8:53 · English · Whisper Turbo · 1 بلندگوها

اين رونوشت امروز تموم ميشه ارتقا برای ذخیره‌سازی دائمی →

نمایۀ سخنرانی

0:11

S… Speaker 1 (2026-04-13 01-48-09)

In this video,

0:12

S… Speaker 1 (2026-04-13 01-48-09)

we're going to go over a quick introduction to what endpoint threat

0:16

S… Speaker 1 (2026-04-13 01-48-09)

hunting is before we start diving into it in a little more

0:21

S… Speaker 1 (2026-04-13 01-48-09)

detail.

0:21

S… Speaker 1 (2026-04-13 01-48-09)

So endpoint threat hunting is primarily performing

0:25

S… Speaker 1 (2026-04-13 01-48-09)

a threat hunt based on IOCs and hypotheses

0:30

S… Speaker 1 (2026-04-13 01-48-09)

and things like that that are typically geared just towards

0:34

S… Speaker 1 (2026-04-13 01-48-09)

your endpoints.

0:35

S… Speaker 1 (2026-04-13 01-48-09)

Now,

0:36

S… Speaker 1 (2026-04-13 01-48-09)

When you're performing a threat hunt in an enterprise environment,

0:40

S… Speaker 1 (2026-04-13 01-48-09)

you're not really going to be performing just an endpoint threat hunt

0:44

S… Speaker 1 (2026-04-13 01-48-09)

or just a network threat hunt.

0:46

S… Speaker 1 (2026-04-13 01-48-09)

You're going to be performing a threat hunt,

0:49

S… Speaker 1 (2026-04-13 01-48-09)

going to be combining both network type and endpoint

0:53

S… Speaker 1 (2026-04-13 01-48-09)

types of IOCs.

0:54

S… Speaker 1 (2026-04-13 01-48-09)

We're just kind of breaking it apart here just to make it a little easier to understand.

0:59

S… Speaker 1 (2026-04-13 01-48-09)

But when we're talking about our endpoint threat hunting,

1:02

S… Speaker 1 (2026-04-13 01-48-09)

we're primarily talking about the IOCs and such that are associated with

1:06

S… Speaker 1 (2026-04-13 01-48-09)

endpoint systems and that are also searched for on your endpoints

1:11

S… Speaker 1 (2026-04-13 01-48-09)

or from your endpoint logs.

1:13

S… Speaker 1 (2026-04-13 01-48-09)

These can be threat hunts that are geared primarily towards

1:18

S… Speaker 1 (2026-04-13 01-48-09)

looking for indicators of compromise or looking for

1:22

S… Speaker 1 (2026-04-13 01-48-09)

your TTPs as the kind of type of hunt you're

1:26

S… Speaker 1 (2026-04-13 01-48-09)

performing.

1:27

S… Speaker 1 (2026-04-13 01-48-09)

These IOCs,

1:28

S… Speaker 1 (2026-04-13 01-48-09)

again, can be either the endpoint types of IOCs or the network

1:33

S… Speaker 1 (2026-04-13 01-48-09)

types of IOCs.

1:34

S… Speaker 1 (2026-04-13 01-48-09)

It's mainly the focus of where the threat hunt

1:38

S… Speaker 1 (2026-04-13 01-48-09)

is looking for specific threats.

1:42

S… Speaker 1 (2026-04-13 01-48-09)

And your threat hunts,

1:44

S… Speaker 1 (2026-04-13 01-48-09)

just like any threat hunt at all,

1:45

S… Speaker 1 (2026-04-13 01-48-09)

can begin with many different types of triggers,

1:48

S… Speaker 1 (2026-04-13 01-48-09)

if you will.

1:49

S… Speaker 1 (2026-04-13 01-48-09)

This can be specific intelligence information that the organization

1:53

S… Speaker 1 (2026-04-13 01-48-09)

receives,

1:54

S… Speaker 1 (2026-04-13 01-48-09)

either internally or externally through a vendor.

1:58

S… Speaker 1 (2026-04-13 01-48-09)

This can be information or reports from your

2:02

S… Speaker 1 (2026-04-13 01-48-09)

internal network team,

2:03

S… Speaker 1 (2026-04-13 01-48-09)

your security operations center,

2:05

S… Speaker 1 (2026-04-13 01-48-09)

anything like that.

2:06

S… Speaker 1 (2026-04-13 01-48-09)

There's a lot of different ways a threat hunt.

2:10

S… Speaker 1 (2026-04-13 01-48-09)

can begin and this is just a couple of different examples of that

2:15

S… Speaker 1 (2026-04-13 01-48-09)

Normally,

2:16

S… Speaker 1 (2026-04-13 01-48-09)

your endpoint threat hunts are going to be done on logs that have been

2:20

S… Speaker 1 (2026-04-13 01-48-09)

collected from various different types of endpoint systems.

2:24

S… Speaker 1 (2026-04-13 01-48-09)

This can be from your authentication logs,

2:27

S… Speaker 1 (2026-04-13 01-48-09)

web application logs,

2:29

S… Speaker 1 (2026-04-13 01-48-09)

any other application,

2:31

S… Speaker 1 (2026-04-13 01-48-09)

any included built -in system events that are built in,

2:35

S… Speaker 1 (2026-04-13 01-48-09)

for example,

2:35

S… Speaker 1 (2026-04-13 01-48-09)

Windows, any logs like that.

2:38

S… Speaker 1 (2026-04-13 01-48-09)

One important part when we're talking about Windows endpoint threat hunting

2:42

S… Speaker 1 (2026-04-13 01-48-09)

is PowerShell.

2:44

S… Speaker 1 (2026-04-13 01-48-09)

PowerShell is very commonly abused by attackers,

2:48

S… Speaker 1 (2026-04-13 01-48-09)

so it is important to make sure the proper PowerShell logging

2:52

S… Speaker 1 (2026-04-13 01-48-09)

is enabled and is going into your kind

2:56

S… Speaker 1 (2026-04-13 01-48-09)

of central logging location.

2:58

S… Speaker 1 (2026-04-13 01-48-09)

Again,

2:59

S… Speaker 1 (2026-04-13 01-48-09)

these logs are going to be collected from many different locations across

3:03

S… Speaker 1 (2026-04-13 01-48-09)

the enterprise.

3:04

S… Speaker 1 (2026-04-13 01-48-09)

We have plenty of other courses and videos at I

3:08

S… Speaker 1 (2026-04-13 01-48-09)

&E.

3:09

S… Speaker 1 (2026-04-13 01-48-09)

for log collection,

3:11

S… Speaker 1 (2026-04-13 01-48-09)

log analysis,

3:12

S… Speaker 1 (2026-04-13 01-48-09)

things like that.

3:13

S… Speaker 1 (2026-04-13 01-48-09)

So we're not going to go into kind of how to set up the logging infrastructure

3:17

S… Speaker 1 (2026-04-13 01-48-09)

in this course.

3:18

S… Speaker 1 (2026-04-13 01-48-09)

But typically these logs are going to be aggregated and collected

3:23

S… Speaker 1 (2026-04-13 01-48-09)

into some sort of a centralized location,

3:25

S… Speaker 1 (2026-04-13 01-48-09)

like a sim or a seam,

3:27

S… Speaker 1 (2026-04-13 01-48-09)

depending on how you want to pronounce it,

3:29

S… Speaker 1 (2026-04-13 01-48-09)

which a lot of times will be where the threat hunt takes place,

3:32

S… Speaker 1 (2026-04-13 01-48-09)

or at least one of the primary locations that you are performing the hunt

3:36

S… Speaker 1 (2026-04-13 01-48-09)

from.

3:38

S… Speaker 1 (2026-04-13 01-48-09)

Now, every good threat hunt,

3:40

S… Speaker 1 (2026-04-13 01-48-09)

every effective threat hunt,

3:42

S… Speaker 1 (2026-04-13 01-48-09)

is going to start with some sort of a trigger or a hypothesis.

3:47

S… Speaker 1 (2026-04-13 01-48-09)

When we're talking about our endpoint threat hunting,

3:49

S… Speaker 1 (2026-04-13 01-48-09)

a couple of examples here.

3:51

S… Speaker 1 (2026-04-13 01-48-09)

You have a hypothesis that attackers have compromised a

3:55

S… Speaker 1 (2026-04-13 01-48-09)

workstation in the environment,

3:57

S… Speaker 1 (2026-04-13 01-48-09)

and they're executing malicious files that match these

4:01

S… Speaker 1 (2026-04-13 01-48-09)

specific file hashes.

4:04

S… Speaker 1 (2026-04-13 01-48-09)

and are sending communication to a command and control server located at

4:08

S… Speaker 1 (2026-04-13 01-48-09)

this specific IP address.

4:10

S… Speaker 1 (2026-04-13 01-48-09)

This is an actionable hypothesis.

4:12

S… Speaker 1 (2026-04-13 01-48-09)

It contains good information that you can use to start

4:17

S… Speaker 1 (2026-04-13 01-48-09)

the threat hunt.

4:18

S… Speaker 1 (2026-04-13 01-48-09)

Again,

4:19

S… Speaker 1 (2026-04-13 01-48-09)

you would have specific caches and specific IP or IPs in

4:24

S… Speaker 1 (2026-04-13 01-48-09)

this hypothesis to start that hunt.

4:26

S… Speaker 1 (2026-04-13 01-48-09)

You could also have something like attackers have already established a foothold

4:31

S… Speaker 1 (2026-04-13 01-48-09)

in the network,

4:31

S… Speaker 1 (2026-04-13 01-48-09)

and for persistence means or persistence techniques,

4:35

S… Speaker 1 (2026-04-13 01-48-09)

they've used...

4:36

S… Speaker 1 (2026-04-13 01-48-09)

I've created administrative accounts in order to maintain their

4:40

S… Speaker 1 (2026-04-13 01-48-09)

access.

4:41

S… Speaker 1 (2026-04-13 01-48-09)

So again,

4:42

S… Speaker 1 (2026-04-13 01-48-09)

you have an effective hypothesis.

4:44

S… Speaker 1 (2026-04-13 01-48-09)

You have specific things to search for.

4:46

S… Speaker 1 (2026-04-13 01-48-09)

In this case,

4:47

S… Speaker 1 (2026-04-13 01-48-09)

you are searching for new account creation.

4:50

S… Speaker 1 (2026-04-13 01-48-09)

And we'll get into detail as we go through this course about how

4:54

S… Speaker 1 (2026-04-13 01-48-09)

to search for all of these.

4:57

S… Speaker 1 (2026-04-13 01-48-09)

Let's look at just a couple of different types of IOCs that are typically

5:01

S… Speaker 1 (2026-04-13 01-48-09)

associated with your endpoints as well.

5:04

S… Speaker 1 (2026-04-13 01-48-09)

So we have your registry keys.

5:06

S… Speaker 1 (2026-04-13 01-48-09)

These are going to be commonly used by attackers or abused by

5:10

S… Speaker 1 (2026-04-13 01-48-09)

attackers for setting up things like auto -run or malicious services

5:15

S… Speaker 1 (2026-04-13 01-48-09)

for their persistence mechanism.

5:18

S… Speaker 1 (2026-04-13 01-48-09)

You also have things like your file names or your process

5:22

S… Speaker 1 (2026-04-13 01-48-09)

names.

5:23

S… Speaker 1 (2026-04-13 01-48-09)

These can be ones that are made to look like

5:27

S… Speaker 1 (2026-04-13 01-48-09)

your more legitimate,

5:28

S… Speaker 1 (2026-04-13 01-48-09)

for example,

5:30

S… Speaker 1 (2026-04-13 01-48-09)

Windows services or Windows processes.

5:32

S… Speaker 1 (2026-04-13 01-48-09)

Or it could be an instance of using those

5:37

S… Speaker 1 (2026-04-13 01-48-09)

legitimate Windows files,

5:39

S… Speaker 1 (2026-04-13 01-48-09)

in this case,

5:40

S… Speaker 1 (2026-04-13 01-48-09)

for malicious purposes.

5:42

S… Speaker 1 (2026-04-13 01-48-09)

There's many different ways to abuse your files here.

5:46

S… Speaker 1 (2026-04-13 01-48-09)

But your file names,

5:47

S… Speaker 1 (2026-04-13 01-48-09)

your process names can be considered or are considered indicators

5:51

S… Speaker 1 (2026-04-13 01-48-09)

of compromise and can be used in searches for a

5:55

S… Speaker 1 (2026-04-13 01-48-09)

threat hunt.

5:56

S… Speaker 1 (2026-04-13 01-48-09)

You also have your file hashes.

5:58

S… Speaker 1 (2026-04-13 01-48-09)

These are used to uniquely identify specific files

6:03

S… Speaker 1 (2026-04-13 01-48-09)

and are very commonly used in your threat hunts.

6:07

S… Speaker 1 (2026-04-13 01-48-09)

You have things like scheduled tasks and services that can

6:11

S… Speaker 1 (2026-04-13 01-48-09)

be used or that are IOCs as well.

6:14

S… Speaker 1 (2026-04-13 01-48-09)

Again, these are used and abused by your attackers for

6:18

S… Speaker 1 (2026-04-13 01-48-09)

persistence mechanisms,

6:20

S… Speaker 1 (2026-04-13 01-48-09)

mainly when we're talking about our scheduled tasks.

6:22

S… Speaker 1 (2026-04-13 01-48-09)

And again, we'll get into the details of how to search for these.

6:26

S… Speaker 1 (2026-04-13 01-48-09)

And these IOCs can come from many different locations

6:30

S… Speaker 1 (2026-04-13 01-48-09)

to begin your threat hunt.

6:32

S… Speaker 1 (2026-04-13 01-48-09)

For example,

6:33

S… Speaker 1 (2026-04-13 01-48-09)

you can get these from various different intelligence sources,

6:36

S… Speaker 1 (2026-04-13 01-48-09)

from third -party intelligence vendors or intelligence

6:40

S… Speaker 1 (2026-04-13 01-48-09)

feeds that you're paying for.

6:42

S… Speaker 1 (2026-04-13 01-48-09)

These can come from your reports from your ISACs,

6:46

S… Speaker 1 (2026-04-13 01-48-09)

your information sharing and analysis centers.

6:50

S… Speaker 1 (2026-04-13 01-48-09)

And again,

6:50

S… Speaker 1 (2026-04-13 01-48-09)

you can get these from paid or free intelligence feeds.

6:55

S… Speaker 1 (2026-04-13 01-48-09)

These can,

6:56

S… Speaker 1 (2026-04-13 01-48-09)

again, come from an internal network team or your internal SOC.

6:59

S… Speaker 1 (2026-04-13 01-48-09)

They can have these IOCs that they relay to the

7:03

S… Speaker 1 (2026-04-13 01-48-09)

threat hunting team or threat hunting personnel to get a threat

7:08

S… Speaker 1 (2026-04-13 01-48-09)

hunt started.

7:08

S… Speaker 1 (2026-04-13 01-48-09)

And a lot of times you're going to search for these,

7:12

S… Speaker 1 (2026-04-13 01-48-09)

you know,

7:12

S… Speaker 1 (2026-04-13 01-48-09)

again, on your,

7:14

S… Speaker 1 (2026-04-13 01-48-09)

you know,

7:15

S… Speaker 1 (2026-04-13 01-48-09)

something like Splunk or Elk.

7:17

S… Speaker 1 (2026-04-13 01-48-09)

But these will be found in system logs primarily.

7:21

S… Speaker 1 (2026-04-13 01-48-09)

Again, there's a lot of different places to search for this.

7:24

S… Speaker 1 (2026-04-13 01-48-09)

Systems logs are a very good example,

7:26

S… Speaker 1 (2026-04-13 01-48-09)

and one of the primary places you'll be searching for these.

7:29

S… Speaker 1 (2026-04-13 01-48-09)

These can be built -in system events like your

7:33

S… Speaker 1 (2026-04-13 01-48-09)

Windows event logs.

7:35

S… Speaker 1 (2026-04-13 01-48-09)

These can be individual application events,

7:38

S… Speaker 1 (2026-04-13 01-48-09)

either from internal logging these applications do,

7:41

S… Speaker 1 (2026-04-13 01-48-09)

or perhaps they may send these logs.

7:44

S… Speaker 1 (2026-04-13 01-48-09)

to the Windows event logs as well.

7:46

S… Speaker 1 (2026-04-13 01-48-09)

We'll talk about what Sysmon is and how it's useful,

7:50

S… Speaker 1 (2026-04-13 01-48-09)

and there are several different events that are helpful to use,

7:54

S… Speaker 1 (2026-04-13 01-48-09)

event IDs that are helpful to use when we're doing threat hunts,

7:57

S… Speaker 1 (2026-04-13 01-48-09)

that are generated by Sysmon.

8:00

S… Speaker 1 (2026-04-13 01-48-09)

And again,

8:01

S… Speaker 1 (2026-04-13 01-48-09)

when we're performing a threat hunt,

8:06

S… Speaker 1 (2026-04-13 01-48-09)

you're going to be combining your endpoint IOCs with your network

8:10

S… Speaker 1 (2026-04-13 01-48-09)

IOCs.

8:10

S… Speaker 1 (2026-04-13 01-48-09)

Again, we've separated them out here just to make it easier to kind of grasp the

8:14

S… Speaker 1 (2026-04-13 01-48-09)

concepts.

8:15

S… Speaker 1 (2026-04-13 01-48-09)

But a lot of times you're going to be combining these IOCs with

8:19

S… Speaker 1 (2026-04-13 01-48-09)

others, especially for correlation purposes,

8:22

S… Speaker 1 (2026-04-13 01-48-09)

and to kind of build the story of what an attacker has

8:26

S… Speaker 1 (2026-04-13 01-48-09)

done as part of that threat hunt.

8:28

S… Speaker 1 (2026-04-13 01-48-09)

And again, there's a lot more IOCs in this.

8:31

S… Speaker 1 (2026-04-13 01-48-09)

This is just a few examples.

8:33

S… Speaker 1 (2026-04-13 01-48-09)

We'll start getting into more details and more IOCs

8:37

S… Speaker 1 (2026-04-13 01-48-09)

as we progress through the course.

این رونوشت توسط AI (شناسایی خودکار گفتار) تولید شد. ممکن است حاوی خطا باشد — برای استفادهٔ حیاتی با صدای اصلی بررسی کنید. سیاست هوش مصنوعی

❤️ عاشق STT.ai هستي؟

خلاصه

برای تولید خلاصه‌ای از این رونوشت از هوش مصنوعی ، خلاصه را فشار دهید.

از هوش مصنوعی در مورد این رونوشت بپرسید

در این روش، هر سؤالی که در مورد این رونوشت پرسیده شود، هوش مصنوعی بخش‌های مربوطه را پیدا کرده و پاسخ می‌دهد.

رونوشت دیگری